Vulnerability feed

Executive summary

A flaw in the Linux kernel's libertas wireless driver lets a short monitor-mode transmit frame be read past the end of its buffer. The advisory does not state a severity rating, and the fix is a kernel patch that adds a length check to reject short monitor frames.

Technical summary

The flaw is an out-of-bounds read in the libertas driver's lbs_hard_start_xmit() function when the interface is in monitor mode. The function casts skb->data to a radiotap TX header and reads the destination address at offset 4 without checking that the frame is long enough, and the generic check only rejects zero-length and oversized frames. The advisory does not state the attack vector or required privileges, and it does not give a CVSS score. The fix adds a check that drops frames shorter than the radiotap TX header plus 4 bytes plus ETH_ALEN, incrementing tx_dropped and tx_errors. Affected and fixed kernel version numbers are not stated in the advisory text. No workaround or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/13ff543e0b2c713…adadde686686e949dc78

Score

No CVSS score published.

Affects

LinuxMarvellLinuxLinux kernelMarvell libertas